Threat Database Backdoors Backdoor:Win32/Losfondup.B

Backdoor:Win32/Losfondup.B

By Domesticus in Backdoors

Backdoor:Win32/Losfondup.B is a backdoor Trojan that enables cybercriminals to obtain full remote access and control over a compromised PC, makes changes to user system and settings accounts, and embeds itself into running processes. While being installed, Backdoor:Win32/Losfondup.B makes system changes by downloading malevolent files and making modifications to the Windows Registry. Backdoor:Win32/Losfondup.B will introduce a user account called 'Local Servlce' by purposefully misspelling 'Local Servlce', instead of 'Service', possibly to dupe attacked PC users into thinking it is a genuine Windows user account. Backdoor:Win32/Losfondup.B may be installed and launched by other malware infections. Backdoor:Win32/Losfondup.B registers itself as a geneuine component of the Windows system service 'SENS' (system even notification service) by making alterations to the registry entry. Backdoor:Win32/Losfondup.B also modifies the registry entries to make sure that its altered version of the 'SENS' service is initiated every time you start Windows. When the Windows system service SENS is launched, Backdoor:Win32/Losfondup.B is run instead of the original, legal one. To conceal its occurrence, Backdoor:Win32/Losfondup.B also fulfills the normal functions of the legal SENS service. To make that the altered version of the 'SENS' service, and, therefore, Backdoor:Win32/Losfondup.B itself, is running instead of the genuine one, Backdoor:Win32/Losfondup.B stops 'svchost.exe' and runs the commands, which initiate the changed 'SENS' service.

SpyHunter Detects & Remove Backdoor:Win32/Losfondup.B

File System Details

Backdoor:Win32/Losfondup.B may create the following file(s):
# File Name MD5 Detections
1. ylccvty.dll
2. [startup folder]\widoexe.js
3. noliwutejnm.dat
4. mnjetuwilon.dat
5. %ALLUSERSPROFILE%\Documents\[reverse malware file name].dat
6. 4251f8a819c7b2999724e177b72bdbff 4251f8a819c7b2999724e177b72bdbff 0
7. ac0e2cd7093d8303cd6d3c1b703be70c ac0e2cd7093d8303cd6d3c1b703be70c 0

Registry Details

Backdoor:Win32/Losfondup.B may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SENS\Parameters "ServiceDll" = "%AllUserProfile%\Application Data\[RANDOM NAME].dat"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\COMSysApp "Start" = "0x02"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SENS "Start" = "0x02"

Trending

Most Viewed

Loading...